Linux kernel NVMe target core (nvmet_req_complete submission-queue dereference): Nvmet_req_complete() dereferenced req

Impact

Nvmet_req_complete() dereferenced req to reach the submission queue after calling __nvmet_req_complete(), which a transport's queue_response implementation is allowed to free. Every completed command on the target passes through this function, so the use-after-free is on the hottest path in the process serving the cluster's block storage - and command completion is driven by whatever the remote initiator submitted.

Who can reach it

Remote, unauthenticated. Any initiator that can submit commands to the target reaches the completion path.

What to do

Kernel update caching the sq pointer before completion. Contain by network segmentation of the storage fabric.

References